/**
 * upgrade-kubernetes.ts — 8-step kubernetes upgrade path for olam upgrade.
 *
 * Phase 1b C2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
 * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
 *
 * Phase 2 Phase C extensions:
 *   C1  — step 2.5: in-memory ConfigMap substitution for inter-peripheral K8s DNS URLs (D4)
 *   C2  — step 2.6: per-peripheral Secret pre-check (iterates PERIPHERALS; D12 pattern)
 *   C3  — step 2.7: CoreDNS warm-up wait + extend steps 3/4/5 to iterate peripherals
 *
 * Phase 2 Phase D extensions:
 *   D5  — OLAM_PHASE_2_BETA guard removed; all peripherals deploy unconditionally (Phase 2 GA)
 *
 * Decisions consumed:
 *   D4  — K8s DNS URL form for inter-peripheral service URLs
 *   D10 — context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality check
 *   D12 — Secret pre-check (base64-decode + key-name + placeholder exact match)
 *   D14 — --force-refresh-manifests flag + --accept-security-regression guard
 *   D15 — kubectl rollout status --timeout=180s; state snapshot on failure
 *   D17 — port-forward spawn via flock (spawnPortForward from port-forward.ts)
 *   D22 — probeKubernetesApiReachable pre-flight via kubectl-wrap (5s timeout)
 *   D27 — audit log entry (phase2.flag_removed) emitted per upgrade run
 *
 * Step order (Phase D — kubernetes substrate, Phase 2 GA):
 *   0    probeKubernetesApiReachable — 5s timeout kubectl cluster-info
 *         (Step 0.5 D4 k3d node bind-mount preflight REMOVED in
 *         olam-k3d-on-mac-substrate-decision Phase B B3 — R3-A retracted.)
 *   0.5b B4 ensureK8sBootstrap (namespace + RBAC + ConfigMap + PVC + secrets)
 *   0.6  R3-C create/update ghcr-pull imagePullSecret in olam namespace (when GH_TOKEN available)
 *         NOTE: relocated from pre-step 0.4 to post-bootstrap (R4-W2-A) — the
 *         `olam` namespace must exist before kubectl can create the secret.
 *   0.7  olam-k3d-on-mac-substrate-decision Phase A — host-side docker-
 *         socket-proxy auto-start on macOS (Decision #1 + #3). Linux substrate
 *         is a no-op. Resolves R4-W2-F (virtiofs ENOTSUP on stat of docker.sock
 *         hostPath bind mounts) by routing host-cp's docker access through a
 *         host-side proxy container reachable via in-cluster ExternalName
 *         Service (host.k3d.internal:2375).
 *   1    D10 context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality byte-for-byte
 *   2    D12 Secret pre-check (olam-host-cp-secret; base64-decode; key-name check)
 *   2.6  C2 per-peripheral Secret pre-check (iterates PERIPHERALS; unconditional — D5)
 *   2.7  C3 CoreDNS warm-up wait (kubectl wait --for=condition=Available deployment/coredns -n kube-system)
 *   3    kubectl apply host-cp manifests + all 4 peripheral manifest dirs (alphabetical)
 *   3.5  C1 in-memory ConfigMap substitution — K8s DNS URLs AFTER step 3 (B7 fix — last-write-wins)
 *   4    D15 kubectl rollout status (all 5 deployments in parallel)
 *   5    D17 port-forward spawn for host-cp + spawnAllPeripheralPortForwards in parallel
 *   6    verify /health returns X-Olam-Engine: kubernetes
 *   7    emit upgrade.complete instrumentation event
 *   8    success message
 *
 * Manifests NOT auto-rolled-back on failure (D15 spec). Operator must
 * manually intervene; state snapshot is printed on failure.
 */
import * as fs from 'node:fs';
import { kubectlWrap } from './kubectl-wrap.js';
import { spawnPortForward, spawnAllPeripheralPortForwards, probePortForwardLiveness, type PortForwardDeps, type PeripheralPortForwardDeps } from './port-forward.js';
import { emitUpgradeComplete, type EmitOpts } from './instrumentation.js';
import { runManifestRefresh, seedManifestsFromBundle, type SeedManifestsDeps } from './manifest-refresh.js';
import { ensureK8sBootstrap, type BootstrapDeps as K8sBootstrapDeps } from './k8s-bootstrap.js';
export declare const OLAM_K8S_MANIFESTS_DIR: string;
export declare const K8S_NAMESPACE = "olam";
export declare const HOST_CP_SECRET_NAME = "olam-host-cp-secret";
export declare const HOST_CP_DEPLOYMENT_NAME = "olam-host-cp";
export declare const PORT_FORWARD_TARGET = "service/olam-host-cp";
export declare const HOST_CP_HEALTH_URL = "http://127.0.0.1:19000/health";
/** Audit log for substrate upgrade events (D18). */
export declare const SUBSTRATE_AUDIT_LOG: string;
export interface UpgradeKubernetesDeps {
    /** Override kubectl-wrap for tests. */
    readonly kubectlWrapImpl?: typeof kubectlWrap;
    /** Override spawnPortForward for tests. */
    readonly spawnPortForwardImpl?: typeof spawnPortForward;
    /** Override spawnAllPeripheralPortForwards for tests. */
    readonly spawnAllPeripheralPortForwardsImpl?: typeof spawnAllPeripheralPortForwards;
    /** Override probePortForwardLiveness for tests. */
    readonly probePortForwardLivenessImpl?: typeof probePortForwardLiveness;
    /** Override fetch for /health verification in tests. */
    readonly fetchImpl?: (url: string, init?: RequestInit) => Promise<Response>;
    /** Override emitUpgradeComplete for tests. */
    readonly emitImpl?: typeof emitUpgradeComplete;
    /** Override manifest refresh for tests. */
    readonly manifestRefreshImpl?: typeof runManifestRefresh;
    /** Override manifests seeder for tests. */
    readonly seedManifestsImpl?: typeof seedManifestsFromBundle;
    /** Override seed manifests deps for tests (injectable to seedManifestsFromBundle). */
    readonly seedManifestsDeps?: SeedManifestsDeps;
    /** Override manifests dir path for tests. */
    readonly manifestsDir?: string;
    /** Override PortForwardDeps for tests (passed into spawnPortForward). */
    readonly portForwardDeps?: PortForwardDeps;
    /** Override PeripheralPortForwardDeps for tests (passed into spawnAllPeripheralPortForwards). */
    readonly peripheralPortForwardDeps?: PeripheralPortForwardDeps;
    /** Override emit opts for tests. */
    readonly emitOpts?: EmitOpts;
    /** Override stdout for tests. */
    readonly stdout?: NodeJS.WritableStream;
    /** Override stderr for tests. */
    readonly stderr?: NodeJS.WritableStream;
    /** Override fs.readFileSync for tests (step 2.5 ConfigMap read). */
    readonly readFileSyncImpl?: typeof fs.readFileSync;
    /** Override Date.now for tests (audit log timestamp). */
    readonly nowImpl?: () => number;
    /**
     * D6: override kubectl config view call for managed-k8s detection.
     * Returns the cluster server URL string, or null when unavailable.
     * Tests inject a mock to avoid real kubectl invocations.
     */
    readonly getClusterServerUrlImpl?: () => Promise<string | null>;
    /**
     * D7 (RETIRED in olam-k3d-on-mac-substrate-decision Phase B B3): the
     * docker socket accessibility preflight is gone (host-cp no longer mounts
     * docker.sock — it talks TCP to docker-socket-proxy). Field kept in the
     * interface so existing test injections compile; the value is never read.
     * New tests should not inject this field.
     */
    readonly checkDockerSocketImpl?: (context: string) => Promise<boolean>;
    /**
     * B3: override config path passed to resolveKubectlContext (tests use a
     * tmpdir fixture). Defaults to the real ~/.olam/config.json.
     */
    readonly configPath?: string;
    /**
     * B4: override the k8s-bootstrap step (tests inject a mock so kubectl
     * isn't called). When omitted defaults to the real `ensureK8sBootstrap`.
     */
    readonly k8sBootstrapImpl?: typeof ensureK8sBootstrap;
    /** B4: pass-through deps for `ensureK8sBootstrap`. */
    readonly k8sBootstrapDeps?: K8sBootstrapDeps;
    /**
     * B3/step 0.4: override the GH token value for tests.
     * When `ghTokenOverrideActive` is true AND `ghTokenOverride` is undefined,
     * the step treats GH_TOKEN as absent (skipped path). When `ghTokenOverride`
     * is a string, that string is used as the token regardless of env/config.
     * When `ghTokenOverrideActive` is falsy (default), real env/config is used.
     */
    readonly ghTokenOverride?: string;
    readonly ghTokenOverrideActive?: boolean;
}
export interface UpgradeKubernetesOpts {
    readonly forceRefreshManifests?: boolean;
    readonly acceptSecurityRegression?: boolean;
    /** B4/B5: regenerate all rendered Secret values (overwrites k8s-secrets-state.json). */
    readonly rotateSecrets?: boolean;
    /**
     * B4: run the namespace + RBAC + secret bootstrap step BEFORE step 1.
     * Default is `false` for direct lib callers (preserves existing test
     * ordering invariants); the CLI command in `upgrade.ts` passes `true` so
     * npm-only operators get the bootstrap automatically. Operators who
     * manage secrets out-of-band (GitOps) can disable via `--skip-k8s-bootstrap`.
     */
    readonly runK8sBootstrap?: boolean;
}
export interface UpgradeKubernetesResult {
    readonly exitCode: number;
    readonly summary: string;
}
/**
 * Main entrypoint for the kubernetes upgrade path.
 *
 * Called from upgrade.ts when host.substrate === 'kubernetes'.
 */
export declare function runUpgradeKubernetes(opts?: UpgradeKubernetesOpts, deps?: UpgradeKubernetesDeps): Promise<UpgradeKubernetesResult>;
//# sourceMappingURL=upgrade-kubernetes.d.ts.map